Skip to main content

Manage Software with JumpCloud Private Repository

With JumpCloud's Software Management Private Repository, you can upload and install Windows and Apple software application files through an intuitive and frictionless interface. You don't have to host custom applications yourself or depend on third-party solutions.

JumpCloud validates each file you upload and extracts its version details. To release a new version, upload the newer binary to the existing application instead of creating a second record.

Benefits of the JumpCloud Private Repository include:

  • Control the files you deploy to your endpoints
  • Eliminate the time and expense involved in setting up and maintaining your own hosting solution
  • Control which applications get installed where, without having to rely on public application repositories

Prerequisites:

  • Requires Windows MDM for MSI deployments.
  • Requires Apple MDM for PKG and IPA deployments.
  • Packages must include valid, signed certifications.

Considerations:

  • The following file types are supported:
    • MSI, EXE (Windows)
    • PKG, DMG (Apple macOS)
    • IPA (iOS and iPadOS)
  • Storage (total across entire repository) is limited to 25GB.
  • Egress (data consumed from the repository) is limited to 10GB per licensed user per month.
  • Maximum allowable application size is 5GB.
  • If the application uploaded to Software Management is already present on bound devices, the custom application automatically installs the version you uploaded based on its bundle ID.
  • Windows EXE files aren't standardized, so they require extra configuration. Jump to Managing Windows EXE Applications.

Known Issues:

  • Windows: When you unbind a device from the application's Devices tab, the status reverts to Install Pending. Don't unbind to remove a custom app from a device. Workaround: manually uninstall the application from the device.

Uploading a Windows Application​

  1. In the JumpCloud Admin Portal, go to Device Management > Software Management > Windows.
Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

  1. Click (+ Add New).
  2. Select JumpCloud Private Repo. A New Custom App panel opens.
tip

To learn about other ways to manage Windows software, see Get Started: Software Management.

  1. Under Application Details, enter the Application Name.
  2. (Optional) Enter a Description.
  3. (Optional) Under Deployment Configurations, enter installer flags in Command Line Options, such as /quiet. For EXE files, also define detection rules and silent flags. Jump to Managing Windows EXE Applications.
note

With all inputs, the msiexec /i command is implied and not needed.

  1. Under Upload File, click Upload File. The Upload File dialog opens.

  1. (Optional) Enter a Display Version, such as v1, to identify the release.
  2. Click Choose A File and select your package, or drag the file into the box. MSI and EXE file types are supported for Windows devices. The dialog confirms the file name and file size.
  3. Click Upload And Validate. Step two of the dialog shows upload progress, then JumpCloud checks whether the package qualifies for managed installation and returns Package Validated or Package Validation Failed. Jump to Resolving Upload and Validation Failures.

  1. Wait for the message "Your application request is still processing" to clear. JumpCloud then populates Package File and Version Information on the Details tab. Jump to Reviewing Application Details.
  2. Bind and install the application. Jump to Binding and Installing Applications on Devices or Device Groups.

Managing Windows EXE Applications​

Windows EXE management requires more granular control. Because these files aren't standardized, you define how the JumpCloud agent installs the software silently and how it confirms the installation succeeded.

Testing Before You Deploy​

  1. Identify silent flags. For public apps, consult vendor documentation. For internal apps, ask your development team for the correct switches.
  2. Install the EXE from a terminal on a test Windows device using those flags, such as setup.exe /S /v /qn. Confirm the app installs in the background with no prompts or pop-up windows.
  3. Run Script A or Script B below to capture the detection values.
  4. Upload the EXE, verify the silent flags, paste your script results into the detection rules, then bind the app to your device groups.

Script A: Getting the Exact Display Name​

$SearchTerm = "*AppPrefix*" # Replace with your app name
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -like $SearchTerm } | Select-Object DisplayName

Script B: Getting the Three Registry Values​

$SearchTerm = "*AppPrefix*" # Replace with your app name
$Paths = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*", "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*", "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*")
Get-ItemProperty -Path $Paths -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like $SearchTerm } | ForEach-Object { [PSCustomObject]@{ "Registry Key Path" = $_.PSParentPath -replace "Microsoft.PowerShell.Core\\Registry::", "" -replace "HKEY_LOCAL_MACHINE", "HKLM" -replace "HKEY_CURRENT_USER", "HKCU"; "Value Name" = "DisplayName"; "Expected Value" = $_.DisplayName } } | Format-List

Configuring EXE Deployment​

Configure EXE deployment under Deployment Configurations, which appears on Windows applications only.

Installation Detection Rules define how the local agent verifies that the application installed successfully. Select a method from the Detection Method dropdown:

  • Display Name: the agent searches the Windows installed programs list for an exact string match. Enter the name in Expected Display Name, exactly as it appears in Windows Add/Remove Programs.
  • Registry: the agent checks for a specific registry key path. Use this method for applications whose display name changes often due to automatic updates.
  • Custom Script: the agent runs a PowerShell script you provide and reports the application as Installed if the script returns an exit code of zero.

Under Silent Flags, the Silent Install Flags field populates detected flags, such as /S, /silent, /q. These suggestions don't work for every version. Verify them with the vendor or on a test device, or leave the field blank for a standard installation.

Capturing Exit Codes for EXE Updates​

When you upload a newer version of an EXE installer, JumpCloud needs an install success exit code to confirm later installations succeed. These codes vary by application and installer technology. Use the JC-ExeExitCodeTest-annotated.ps1 script attached to this article to find the code for your file.

The script and its results are provided on a best effort basis. Test the results, and validate them with the application developer if needed.

To capture the exit code:

  1. Place the newer EXE installer on a Windows test device.
  2. Save the attached script as a .ps1 file. Don't paste the full script into an interactive PowerShell window.
  3. At the top of the script, set the configuration values for your application:
$SourceInstallerPath = 'C:\Path\To\ApplicationSetup.exe'
$InstallerArguments = '/S'
  1. Confirm the silent installation arguments in the vendor's documentation. Vendors use values such as /S, /silent, /quiet, or --silent. These arguments must match the ones you configure in JumpCloud.
  2. (Optional) Set $ExpectedExecutablePath and $ExpectedVersion for a post-install check. Leave them blank to discover only the exit code.
  3. Open PowerShell using Run as administrator and run the script:
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Temp\JC-ExeExitCodeTest-annotated.ps1"
note

The -ExecutionPolicy Bypass value applies only to this invocation. It doesn't change the machine's global execution policy.

The script outputs the installer process exit code. That value becomes your candidate success code.

To validate the code in JumpCloud:

  1. On a test device with the older version installed, configure the newer EXE as the application update.
  2. Enter the candidate exit code in the accepted success exit code field.
  3. Use the same installation arguments you tested with the script.
  4. Target only the test device or a pilot group, then run the update.
  5. Confirm JumpCloud reports the application as Installed and verify the newer version on the pilot device. Expand the update to more devices only after both checks pass.

Uploading an Apple Application​

Apple deployment supports PKG, DMG, and IPA files, but compatibility depends on the device type. PKG and DMG files are supported on macOS devices only. IPA files are supported on iOS and iPadOS devices only.

  1. In the Admin Portal, go to Device Management > Software Management > Apple.
  2. Click (+ Add New).
  3. Select JumpCloud Private Repo. A New Custom App panel opens.
tip

To learn about other ways to manage software on Apple devices, see Get Started: Software Management.

  1. Under Application Details, enter the Application Name.
  2. (Optional) Enter a Description.
  3. Under Upload File, click Upload File. The Upload File dialog opens.

  1. (Optional) Enter a Display Version, such as v1, to identify the release.
  2. Click Choose A File and select your package, or drag the file into the box. PKG, DMG, and IPA file types are supported for Apple devices. The dialog confirms the file name and file size.
  3. Click Upload And Validate. Step two of the dialog shows upload progress, then JumpCloud checks whether the package qualifies for managed installation and returns Package Validated or Package Validation Failed. Jump to Resolving Upload and Validation Failures.
  4. Wait for the message "Your application request is still processing" to clear. JumpCloud then populates Package File and Version Information on the Details tab. Jump to Reviewing Application Details.
  5. Bind and install the application. Jump to Binding and Installing Applications on Devices or Device Groups.

Managing Installation Settings and Updating Versions​

Reviewing Application Details​

After validation completes, the application's Details tab shows the metadata JumpCloud extracted from the file. The tab also includes Deployment Configurations on Windows applications, Installation Settings on Apple applications, and Update Version on both.

SectionFieldDescription
Package FileFile NameThe uploaded file
Package FileFile SizeSize of the uploaded file
Package FileUpload DateDate and time of the upload
Version InformationDisplay VersionThe label you entered during upload
Version InformationPackage VersionThe version parsed from the package
Version InformationShort VersionThe short version string, when the package provides one
Version InformationVersion Last UpdatedDate and time of the most recent version upload
Version InformationPackage StatusAvailable when the package is ready to deploy

Configuring Installation Settings for Apple Applications​

Installation Settings appears on the Details tab of Apple applications. It reports the validation result and controls whether JumpCloud manages the application on the device.

  • Package Validation shows the result of the check that ran at upload. A PASS badge and App Management Eligible mean the package qualifies for managed installation.
  • App Management controls whether JumpCloud manages the installation. Select the Install as Managed checkbox to turn it on. JumpCloud selects it for you when the package passes validation. When a managed application's MDM profile is removed from a device, the application is deleted with it.

A banner confirms the result: "This app passed prerequisite checks. If the OS requires additional parameters and the installation fails, uncheck this and redeploy."

JumpCloud evaluates eligibility only during upload. Applications created before this feature was released default to unmanaged. To evaluate one of them, upload the file again from Update Version. Jump to Updating an Application Version.

Updating an Application Version​

Upload a newer binary to an existing application to release a new version, or to re-evaluate a file for managed installation. JumpCloud deploys the new version to bound devices, so you don't unbind older versions or rebuild bindings.

note

Before you update a Windows EXE application, capture its install success exit code on a test device. JumpCloud needs that code to confirm the update installed. Jump to Capturing Exit Codes for EXE Updates.

  1. In the Admin Portal, go to Device Management > Software Management.
  2. Choose the OS tab, then click the application you want to update.
  3. On the Details tab, expand Update Version.
  4. Click Upload File. The Upload File dialog opens.
  5. (Optional) Enter a Display Version for the new release.
  6. Click Choose A File and select the new package, or drag the file into the box.
  7. Click Upload And Validate. JumpCloud validates the file and maps it to the existing application record.
  8. For EXE files, enter the install success exit code. Jump to Capturing Exit Codes for EXE Updates.

Resolving Upload and Validation Failures​

Validation results appear when you open the application from the Software Management list.

  • Package Validation Failed: JumpCloud couldn't validate the package for managed installation, such as an unsigned Windows EXE installer. Click Start Over and select a properly signed file.
  • The file upload failed: a message on the Details tab reads "The file upload failed. Please delete this instance and try again." Click Delete, then upload the file again.

A validation error can mean the vendor didn't digitally sign the file. Contact the vendor for a signed file.

To check the digital signature:

  1. Right-click the MSI file, then click Properties > Digital Signatures. If the file is signed, you see the name of the signer. Click Details to view the certificate.
  2. Confirm a trusted Certificate Authority (CA) issued the certificate.
  3. Confirm the certificate hasn't expired. An expired certificate can mean the package isn't trustworthy.
  4. Confirm the publisher matches the expected publisher of the package. If the publisher is unfamiliar, the package might not be valid.

Binding and Installing Applications on Devices or Device Groups​

note

If you're adding a new managed software application, you can bind and install it directly after uploading it.

  1. In the JumpCloud Admin Portal, go to Device Management > Software Management.
  2. Choose the OS tab and find the application you want to bind or unbind.
  3. Click to open the managed application details.
  4. To install on individual devices, go to the Devices tab and select the devices.

  1. To install for groups of devices, click the Device Groups tab and select the device groups. The application installs on all devices in the group with an eligible OS.
    • To unbind device groups, select Show bound device groups, then clear the selection next to the groups you want to unbind. Unbinding a device group removes bindings for all devices in that group.
    • Unbinding doesn't uninstall the application from those devices.

note

If the device group has dynamic membership controls, devices are added and removed over time based on the rule-based attributes of the group. See Configure Dynamic Device Groups. You can't remove an individual bound device from a dynamic group within Software Management, because the device is re-enrolled if it still meets the group's attributes. Unbind the device from the dynamic group under Device Groups first.

  1. Click Save.
  2. A Manage software associations confirmation appears. Select I understand this can't be undone, then click Install.

  1. A success message indicates whether the installation succeeded.
    • MSI packages are downloaded to C:\Windows\System32\config\systemprofile\AppData\Local\mdm and installed at C:\Program Files\.

Viewing the Status of Managed Software​

  1. From the managed application details screen, click the Status tab to see every device where the application is bound and its installation status.
    • For Windows devices:
      • Install Failed: installation failed. Click Retry to retry on a single device.
      • Install Success: installation succeeded and JumpCloud manages the application on the device.
      • Install Pending: installation is in progress. No action is required.
    • For Apple devices:
      • Command Failed: installation failed. Click Retry to retry on a single device.
      • Command Sent: the install command was sent, but JumpCloud can't confirm the device installed the application.
      • Install Pending: installation is in progress. No action is required.
  2. Click View to see results for an individual device, including version information and expanded status details.

Deleting Managed Software Configurations​

note

Deleting a managed software instance doesn't uninstall the application from bound devices.

To delete managed software:

  1. In the Admin Portal, go to Device Management > Software Management.
  2. Choose the OS tab and select the application you want to delete.
  3. Go to Actions > Delete. A confirmation modal appears.
    • For Apple software packages, if you're removing more than one app, enter the total number of packages to be deleted, then click Delete App(s).
    • For Windows software packages, click Delete.

JumpCloud no longer manages the application.

Troubleshooting​

A Windows MSI Package Fails to Install

The status message reads similar to "enforcement failed for MDM app installation for custom app name x at version x". The install can fail because the installer isn't compatible with the Windows version, the application is already installed at a greater version and a downgrade isn't allowed, another install is in progress or stuck, or the device has a network connectivity issue.

Some failures recover with a retry and some don't. Microsoft MDM can't distinguish between the failures by the status Windows sends, so it keeps retrying. Windows tries to install apps three times before sending a failure status to Microsoft MDM. Microsoft MDM then sends a failed status to the relevant devices and schedules the install to retry in 24 hours.

A Windows Application Reports Success but Isn't on the Device

A hosted Windows application can report a successful install in the Admin Portal while the application isn't present in the user's profile or installed programs list. This happens with applications that install to a user's local profile, because MDM commands run as the System user account. The application installs to C:\Windows\System32\config\systemprofile\AppData instead, usually in the AppData\Local folder of that profile.

MDM commands don't support installation in the user context. As a workaround, use the Run as User command template to install the application in the end user's context. See Create a Command from a Template. The end user might need temporary elevated privileges, such as local administrator rights, to install the software.

Learn More​

Was this information helpful?